Commit 642ac774 authored by Johan Hedberg's avatar Johan Hedberg Committed by Marcel Holtmann
Browse files

Bluetooth: Fix missing check for SMP session in smp_user_confirm_reply 



The smp_user_confirm_reply() function is called whenever user space
sends a user confirmation reply mgmt command. In case of a misbehaving
user space, or if the SMP session was removed by the time the command
comes it is important that we return an appropriate error and do not try
to access the non-existent SMP context. This patch adds the appropriate
check for the HCI_CONN_LE_SMP_PEND flag before proceeding further.

Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent a9999348

net/bluetooth/smp.c

+1 −1
Original line number Diff line number Diff line
@@ -638,7 +638,7 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey) 


	BT_DBG("");



	if (!conn)

	if (!conn || !test_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))

		return -ENOTCONN;



	smp = conn->smp_chan;